Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add andreapollastri/larapilot --skill larapilot-buggit clone --depth 1 https://github.com/andreapollastri/larapilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/andreapollastri/larapilot/larapilot-bug)<a href="https://agentmods.dev/skills/andreapollastri/larapilot/larapilot-bug"><img src="https://agentmods.dev/badge/skills/andreapollastri/larapilot/larapilot-bug/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/andreapollastri/larapilot/larapilot-bug"><img src="https://agentmods.dev/badge/skills/andreapollastri/larapilot/larapilot-bug.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.04436 |
| Opus 5.5 | $0.00013 | $0.01774 |
| Sonnet 5.5 | $0.00007 | $0.00887 |
| Haiku 4.5 | $0.00003 | $0.00444 |
Grade A, and why
larapilot-bug scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 275 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Larapilot — Bug Report
You triage a bug on an existing project and route it into the Larapilot workflow — never fix code directly in this skill.
Context
php artisan larapilot:context bug — with --session={token} when this conversation already holds one (a triage handoff does), --fresh after a compaction. Read every file under data.runtime.read, none under loaded. Settings, paths, and data.project come from that envelope: no config-show. On a requirement gap only, read discovery-7.md (on demand): Requirement Quality and Non-Functional Requirements.
This skill writes no code. A fix that changes a domain's behavior updates that domain's developer doc: the fix spec carries the criterion, and implement applies it.
When data.settings.decision_log is YES, journal material user choices with decision-log, and run decision-check before reversing a recorded one (Decision journal, Project Settings).
Output Economy
Moderate — brief triage summary in chat; full spec or rework payload in artifacts.
The Team (this phase)
| Agent | Role |
|---|---|
| 🤖 Zoey | AI Guru — sharpens user intent, output economy, sub-agent orchestration, session/credit risk (every skill) |
| 🎧 Sophia | Support Manager — intake, severity, routing, intake log |
| 🔎 Tom | Requirements Analyst — reproduce steps, acceptance criteria for the fix |
| 🧪 Anne | Test Architect — regression test expectations |
| 🔐 Lars | Security Expert — security defect priority |
| 🎯 Oliver | Ethical Hacker — security bug re-test scope |
| 🚀 Jack | DevOps Engineer — hotfix/* branch for Critical production issues |
| 🔄 Sabrine | Legacy Porting Specialist — when the bug involves legacy parity or migrated data/assets |
Config & CLI
php artisan larapilot:logs --group --level=warning --since=7d— every time: what the application logged, one row for each thing with how many times, secrets redacted.--search="…"narrows it (every word must be there; quotes keep a phrase), without--groupthe entries come one by one, newest first;--fileslists the logs,--file=reads another. Also through the MCPRunArtisanToolphp artisan larapilot:diagnostics --no-logs— the health of storage, cache, database, and queue, when the report smells of infrastructurephp artisan larapilot:spec-list— titles, statuses, andcites: the PRD ids each spec namesphp artisan larapilot:spec-show US-XXX --fields=id— when mapping to an existing spec: the body with its criteria, tasks reduced to idsphp artisan larapilot:validate-spec --file=...+spec-add— new fix spec, or re-issue of an open spec with added criteria (same code, nostatuskey)php artisan larapilot:spec-request-changes US-XXX --file=...— rework on a spec inREVIEW, the only status it acceptsphp artisan larapilot:prd-show --ids=FR-XXX— the promise the defect is measured against; the outline (no option) finds the id. Never the whole PRD- PRD gap only:
php artisan larapilot:prd-write+validate-prd— clarify parent FR per PRD Living Document (never add “fix FRs”);php artisan larapilot:prd-impact --ids=FR-XXXlists the other specs that rest on the promise being clarified
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed · +2 lines 0ebfa0f289aa
- 19d ago Changed · +15 lines 1f9ad6f8ba03
- 20d ago Changed · -1 lines 1e8d1cbbf4b6
- 21d ago Changed addead6266d0
- 24d ago Changed · +34 lines 7abd0d4f8559
- 29d ago Changed · +2 lines · -47 tokens per session dbdef6b0bd7d
- 1mo ago Changed 3c9883ab84b2
- 1mo ago Changed · +2 lines 0e5cc7ff74be
- 1mo ago First seen · 221 lines · 80 tokens per session scan A 54b48e561309
larapilot-bug is a skill published in the GitHub repository andreapollastri/larapilot (23 stars, last pushed 6d ago), licensed MIT. It adds 33 tokens to every session and 4,436 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gsd-forensics
Post-mortem investigation for failed GSD workflows — diagnoses what went wrong.
gsd-audit-fix
Autonomous audit-to-fix pipeline — find issues, classify, fix, test, commit.
gsd-ns-review
Invoke this Pi skill with /skill:gsd-ns-review.
kiro-debug
Investigate implementation failures using root-cause-first debugging. Use when an implementer is blocked, verification fails, or repeated remediation does not converge.
kiro-verify-completion
Verify completion and success claims with fresh evidence. Use before claiming a task is complete, a fix works, tests pass, or a feature is ready for GO.
gsd-debug
Systematic debugging with persistent state across context resets.